@samanbayaka/core 0.0.1

package/commit-hash.mjs

@@ -0,0 +1 @@
+export const COMMIT_HASH = '125c4ea';

package/helper/mol-built-in/AjvValidator.mjs

@@ -0,0 +1,90 @@
+/*AjvValidator.mjs*/
+
+import Ajv from "ajv"
+import addFormats from "ajv-formats"
+import { Validators, Errors } from "moleculer"
+
+const ajv = new Ajv({
+  allErrors: true,
+  strict: false,
+  coerceTypes: true   //true auto fit data to integer data type like 12 if supplied "12"
+})
+
+addFormats(ajv)
+
+export class AjvValidator extends Validators.Base {
+  constructor() {
+    super()
+    this.ajv = ajv
+  }
+
+  compile(schema) {
+    const validate = this.ajv.compile(schema)
+
+    return (params) => {
+      const valid = validate(params)
+
+      if (!valid) {
+        return formatAjvErrors(validate.errors, params)
+      }
+      return true
+    }
+  }
+}
+
+
+export const validateOAS = (params, schema) => {
+  const validate = ajv.compile(schema)
+  const valid = validate(params)
+  if (!valid) {
+    throw new Errors.ValidationError(
+      "Validation failed",
+      "VALIDATION_ERROR",
+      formatAjvErrors(validate.errors, params)
+    )
+  }
+  return valid
+}
+
+
+/**
+ * Format AJV Errors
+ * @param  {error object}
+ * @param  {params object}
+ * @return {array}
+ */
+const formatAjvErrors = (errors, params) => {
+	if(!errors){
+	  return false
+	}
+
+  return errors.map(err => {
+
+  	/**
+  	 * Remove leading "/" and subsequent "/" to "."
+  	 * @type {string}
+  	 */
+  	const path = err.instancePath
+    				.replace(/^\/+/, '')
+    				.replace(/\//g, '.')  
+
+    /**
+     * Getting value from nested object
+     * @param  {string} like query.name.lastName
+     * @return {string}
+     */
+    const val = path.split('.').reduce((acc, key) => acc?.[key], params)
+
+    if (err.keyword === "required") {
+      return {
+        path,
+        message: `Must have required property '${err.params.missingProperty}' in the path object.`
+      }
+    }
+    return {
+    	path,
+    	message: `The value '${val}' ${err.message}`
+    }
+  })
+  
+}

package/helper/mol-built-in/CustomLogger.mjs

@@ -0,0 +1,83 @@
+import pino from "pino"
+
+const pinoOptions = {
+  /**
+   * ISO timestamps
+   */
+  timestamp: pino.stdTimeFunctions.isoTime,
+
+  /**
+   * base fields = Loki labels candidates
+   */
+  base: null,
+
+  /**
+   * Rename default fields (optional but cleaner for Loki)
+   * @type {Object}
+   */
+  // formatters: {
+  //   level(label) {
+  //     return { level: label } // instead of numeric
+  //   }
+  // },
+
+  serializers: {
+    err: pino.stdSerializers.err
+  },
+
+  // messageKey: "message",
+  nestedKey: 'data',
+  // msgPrefix: " ❖❖ SBK ❖❖ ",
+  hooks: {
+    logMethod(args, method, level) {
+      let mergedObj = {tag: "MOL", msgHdr: " ━━━━━━━❖❖ SBK ❖❖━━━━━━━ ", message: ""}
+      let messages = []
+      let tag
+
+      for (const arg of args) {
+        if (typeof arg === 'string') {
+          messages.push(arg.replace(/\u001b\[[0-9;]*m/g, " "))
+        } 
+        else if (arg && typeof arg === 'object') {
+          if( arg.message ){
+            arg.message = typeof arg.message === 'object'
+              ? JSON.stringify(arg.message)
+              : arg.message
+            messages.push(arg.message)
+          }
+          mergedObj = { ...mergedObj, ...arg }
+        }
+      }
+
+      /**
+       * Delete message header when tag is not "SBK"
+       */
+      if( !(mergedObj?.tag == "SBK") ){
+        delete mergedObj.msgHdr
+      }
+
+      /**
+       * Rebuild args into standard Pino format
+       */
+      args = [{...mergedObj, message: messages.join(' ')}]
+
+      method.apply(this, args)
+    }
+  },
+}
+
+
+export default (opts) => {
+  const { logger, logLevel } = opts
+  return logger == "CustomLogger"
+  ? {
+      type: "Pino",
+      options: {
+        level: (logLevel || "info").toLowerCase(),
+        pino: {
+          options: pinoOptions
+        }
+      }
+    }
+  : "Console"
+}

package/helper/mol-built-in/HybridCacher.mjs

@@ -0,0 +1,155 @@
+import { Cachers } from "moleculer"
+
+const MAX_L1_TTL = 600    // 10 minutes in seconds
+const MAX_L2_TTL = 8640_000  // 100 days in seconds
+const MAX_DATA_SZ = 10*1024*1024  // maximum data size in byte
+
+export default class HybridCacher extends Cachers.Base {
+  constructor(opts = {}) {
+    super(opts)
+
+    this.memory = new Cachers.MemoryLRU({
+      max: opts.max || 1000,
+      ttl: opts.ttl[1]
+    })
+
+    this.redis = new Cachers.Redis({
+      ttl: opts.ttl[0],
+      redis: opts.redis
+    })
+  }
+
+  async init(broker) {
+    this.logger = broker.logger
+    await this.memory.init(broker)
+    await this.redis.init(broker)
+  }
+
+
+  /**
+   * Helper to extract key prifix used by redis
+   * @param  {string} key
+   * @return {string}
+   */
+  getRedisCatchKey(key) {
+    return this.redis.prefix ? this.redis.prefix + key : key
+  }
+
+  async get(key) {
+    const prefixedKey = this.getRedisCatchKey(key)
+
+    /**
+     * Try L1 first
+     * @type {object | string}
+     */
+    let data = await this.memory.get(prefixedKey)
+    if (data) {
+      this.logger.debug({tag: "SBK", message: 'L1 Hits'})
+      return data
+    }
+
+    /**
+     * Fallback to Redis
+     * @type {object | string}
+     */
+    data = await this.redis.get(key)
+    if (data) {
+      /**
+       * Warm L1 using the TTL of L1 and the remaining time to L2, whichever is lower.
+       */
+      const l1WarmTTL = Math.min((data.ttl[0] - ( Date.now() - data.txnTs)/1000), data.ttl[1])
+      this.logger.debug({tag: "SBK", message: 'L2 Hits'})
+      if( l1WarmTTL > 0 ) {
+        await this.memory.set(prefixedKey, data.result, l1WarmTTL)
+      }
+    }
+
+    return data?.result
+  }
+
+  async set(key, data, ttl, meta = {}) {
+    const prefixedKey = this.getRedisCatchKey(key)
+
+    const dataSize = ((szData = this.redis.serializer.serialize(data)) => {
+      return Buffer.isBuffer(szData)
+        ? szData.length
+        : Buffer.byteLength(szData)
+    })()
+
+    if(dataSize > MAX_DATA_SZ){
+      this.logger.error({
+        tag: "SBK",
+        message: `Cache data size is '${dataSize}' bytes exceeds the configured limit`
+      })
+      return
+    }
+
+    /**
+     * Normalize global TTL
+     * @type {[number]}
+     */
+    const globalTTL = Array.isArray(this.opts.ttl)
+      ? [this.opts.ttl[0], this.opts.ttl[1] || 0]
+      : [this.opts.ttl || 0, 0]
+
+    /**
+     * Normalize incoming TTL
+     */
+    let L1TTL = 0
+    let L2TTL = 0
+
+    if (Array.isArray(ttl)) {
+      L2TTL = ttl[0]
+      L1TTL = ttl[1] || 0
+    } else if (typeof ttl === "number") {
+      L2TTL = ttl
+    }
+
+    const safeL2TTL = Math.min(L2TTL, globalTTL[0], MAX_L2_TTL)
+    const safeL1TTL = Math.min(L1TTL, globalTTL[1], MAX_L1_TTL)
+
+    /**
+     * Store in Redis (L2) when safeL2TTL > 0 and safeL2TTL > safeL1TTL
+     */
+    if( safeL2TTL > 0 && safeL2TTL > safeL1TTL ){
+      await this.redis.set(key, {result:data, ttl:[safeL2TTL, safeL1TTL], txnTs: Date.now()}, safeL2TTL)
+    }
+    
+    /**
+     * Only store in Memory if l1TTL > 0
+     */
+    if (safeL1TTL > 0) {
+      await this.memory.set(prefixedKey, data, safeL1TTL)
+    }
+  }
+
+  async del(keys) {
+    await this.redis.del(keys)
+    await this.memory.del(keys)
+
+  }
+
+  async clean(match) {
+    await this.redis.clean(match)
+
+    let matchs = Array.isArray(match) ? match : [match]
+    matchs = matchs.map(el => el.replace("*", ""))
+
+    for (const patt of matchs){
+      const mKeys = this.memory.cache.keys()
+      let key = mKeys.next()
+      while (!key.done) {
+        if ( key.value.includes(patt) ) {
+          this.memory.cache.delete(key.value)
+          this.logger.debug({
+            tag: "SBK",
+            message: "REMOVE MEMORY LRU KEY",
+            key
+          })
+        }
+        key = mKeys.next()
+      }
+    }
+    
+  }
+}

package/helper/utility/access-token-validator.mjs

@@ -0,0 +1,249 @@
+import { Errors } from "moleculer"
+import ApiGateway from "moleculer-web"
+import jwt from "jsonwebtoken"
+import jwksClient from "jwks-rsa"
+
+import * as configHdl from '#hUti/config-handler.mjs'
+
+const ACCESS_ROLES = await configHdl.getConfigs('/config/sbk/edge/yaml/roles')
+const OPENID_CONFIG = await configHdl.getConfigs('/config/sbk/edge/yaml/auth')
+export const {clientId} = OPENID_CONFIG
+
+/**
+ * Initializes OpenID Connect configuration and JWKS client.
+ *
+ * Fetches the OpenID configuration document from the configured
+ * issuer endpoint and creates a cached JWKS client for JWT
+ * signature verification.
+ *
+ * The JWKS client supports:
+ * - Automatic key retrieval
+ * - In-memory caching
+ * - Request rate limiting
+ *
+ * @async
+ * @function getOpenidConfigs
+ *
+ * @throws {Error} Throws if the OpenID configuration request fails
+ * or the response cannot be parsed.
+ *
+ * @returns {Promise<void>}
+ */
+const getOpenidConfigs = async () => {
+
+  const response = await fetch(OPENID_CONFIG.url)
+
+  if ( !response.ok ) {
+    throw new Error(
+      `OpenID configuration endpoint failed with status "${response.status}"`
+    )
+  }
+
+  return await response.json()
+}
+
+export const {
+  issuer,
+  jwks_uri: jwksUri,
+  authorization_endpoint: authorizationEndpoint,
+  token_endpoint: tokenEndpoint,
+  end_session_endpoint: endSessionEndpoint,
+} = await getOpenidConfigs()
+
+const client = jwksClient({
+  ...OPENID_CONFIG.jwksClient,
+  jwksUri: jwksUri,
+})
+
+const issuers = ((iss) => {
+  const httpUrl = new URL(iss)
+  httpUrl.protocol = "http:"
+  httpUrl.port = String(OPENID_CONFIG.kcPort)
+  return [
+    iss,
+    httpUrl.toString(),
+  ]
+})(issuer)
+
+
+/**
+ * Retrieves the public signing key corresponding to a JWT `kid`.
+ *
+ * Used by JWT verification libraries (such as `jsonwebtoken`)
+ * to dynamically resolve signing keys from a JWKS endpoint.
+ *
+ * @param {Object} header - Decoded JWT header.
+ * @param {string} header.kid - Key ID used to identify the signing key.
+ * @param {Function} callback - Callback function invoked after key retrieval.
+ * @param {Error|null} callback.err - Error object if key retrieval fails.
+ * @param {string|null} callback.key - PEM formatted public key.
+ *
+ * @returns {void}
+ */
+const getKey = (header, callback) => {
+
+  client.getSigningKey(
+    header.kid,
+    (err, key) => {
+
+      if (err) {
+        callback(err)
+        return
+      }
+
+      callback(
+        null,
+        key.publicKey || key.rsaPublicKey
+      )
+    }
+  )
+
+}
+
+
+
+/**
+ * Authenticates the requester by verifying the access token.
+ * The token can be provided either in the Bearer Authorization header
+ * or in cookies.
+ *
+ * @param {Context} ctx - Moleculer service context
+ * @param {Object} route - REST route configuration object
+ * @param {HTTP request<Object>} req - HTTP request object
+ * @returns {Promise<Object>} Authenticated user / authorization result
+ */
+export const authenticate = async (ctx, route, req, res) => {
+
+  let token = null
+
+  const auth =
+    req.headers.authorization
+
+  if (auth?.startsWith("Bearer ")) {
+    token = auth.replace(/^Bearer\s+/i, "")
+  }
+
+
+  if (
+    !token &&
+    req.cookies?.WbsedclAccessToken
+  ) {
+    token = req.cookies?.WbsedclAccessToken
+  }
+
+
+  if (!token) {
+    throw new ApiGateway.Errors.UnAuthorizedError(
+      ApiGateway.Errors.ERR_NO_TOKEN
+    )
+  }
+
+  try {
+    const decoded =
+      await new Promise((resolve, reject) => {
+
+        jwt.verify(
+          token,
+          getKey,
+          {
+            algorithms: OPENID_CONFIG.jwtVerifyAlgo,
+            issuers,
+            // audience: OPENID_CONFIG.audience,
+          },
+
+          (err, dec) => {
+
+            if (err) {
+              reject(err)
+              return
+            }
+
+            resolve(dec)
+          }
+        )
+      })
+
+    ctx.broker.logger.debug({tag: "SBK", message: "Decoded Token Object", token: decoded, OPENID_CONFIG, issuers})
+    // ctx.meta.user = {
+    //   sessionId: decoded?.sid,
+    //   id: decoded?.sub,
+    //   userId: (decoded?.sub).split(":").at(-1),
+    //   username: decoded?.preferred_username,
+    //   firstName: decoded?.given_name,
+    //   lastName: decoded?.family_name,
+    //   fullName: [...new Set(decoded?.name.split(/\s+/))].join(" "),
+    //   emailIds: decoded?.email,
+    //   mobileNos: decoded?.mobile_no,
+    //   userRoles: decoded?.user_role,
+    // }
+    return decoded
+
+  } catch (err) {
+    ctx.broker.logger.debug({tag: "SBK", OPENID_CONFIG})
+    throw new ApiGateway.Errors.UnAuthorizedError(
+      ApiGateway.Errors.ERR_INVALID_TOKEN
+    )
+  }
+}
+
+/**
+ * Verifies the user's roles and access grants before authorizing
+ * access to the requested resource.
+ * @param  {object} ctx   [description]
+ * @param  {object} route [description]
+ * @param  {object} req   [description]
+ * @param  {object} res   [description]
+ * @return {object}       [description]
+ */
+export const authorize = async(ctx, route, req, res) => {
+
+  ctx.broker.logger.debug({tag: "SBK", message: "User Profile"}, ctx.meta.user, route?.path)
+
+  if( ctx.meta?.user?.preferred_username === undefined ){
+    throw new ApiGateway.Errors.UnAuthorizedError(
+      ApiGateway.Errors.ERR_INVALID_TOKEN
+    )
+  }
+
+  ctx.broker.logger.debug({tag: "SBK", message: "ACCESS_ROLES", ACCESS_ROLES, resource_access: ctx.meta.user.resource_access})
+
+  // resource_access
+
+  // const aa = new RegExp("^/system/oidc(?:/.*)?$", "i")
+  // if()
+
+  // if( req.url.startsWith("/system" ){
+
+  // }
+
+
+  // /**
+  //  * Resticed accessor can't access all resources
+  //  */
+  // if( ctx.meta?.user?.preferred_username == OPENID_CONFIG.rAccessor ){
+  //   throw new Errors.MoleculerError(
+  //     "You are not authorized to access this resource",
+  //     403,
+  //     "FORBIDDEN"
+  //   )
+  // }
+
+  // if( ctx.meta.user?.azp == clientId && req.url.startsWith(OPENID_CONFIG.rRoute)) {
+  //   throw new Errors.MoleculerError(
+  //     "You are not authorized to access this resource",
+  //     403,
+  //     "FORBIDDEN"
+  //   )
+  // }
+
+  // if( ctx.meta.user?.azp == OPENID_CONFIG.rAccessor && !req.url.startsWith(OPENID_CONFIG.rRoute)) {
+  //   throw new Errors.MoleculerError(
+  //     "You are not authorized to access this resource",
+  //     403,
+  //     "FORBIDDEN"
+  //   )
+  // }
+
+  return Promise.resolve(ctx)
+}
+

package/helper/utility/aux-broker-params-validator.mjs

@@ -0,0 +1,126 @@
+export const auxBrokerParamsValidator = (paramObj) => {
+  
+  let serviceNamePrefix = "producer"
+  const optsKeys = Object.keys(paramObj.opts || {})
+
+  /**
+   * Callback function.
+   *
+   * @callback Callback
+   * @param {...*} args - Arguments passed to the callback.
+   * @returns {boolean} Returns `true` by default when the original callback returns `null` or `undefined`.
+   */
+  if (typeof paramObj.callback !== 'function') {
+    paramObj.callback = () => true
+  } 
+  else {
+    const originalCallback = paramObj.callback
+  
+    paramObj.callback = (...args) => {
+      return originalCallback(...args) ?? true
+    }
+  }
+ 
+  /**
+   * Throws an error when type is undefined
+   */
+  if ( !paramObj.type ) {
+    throw new Error("The \"type\" argument is missing.")
+  }
+
+
+  /**
+   * Determines and assigns the service name based on the provided options.
+   *
+   * Behavior:
+   * - If no option keys are provided:
+   *   - Sets the service type prefix to `"producer"`.
+   *   - Automatically generates the service name using the format:
+   *     `"producer-<type>"`.
+   *
+   * - If option keys are present:
+   *   - Ensures that `opts.name` is explicitly provided.
+   *   - Throws an error if the `name` key is missing.
+   *   - Sets the service type prefix to `"consumer"` when the
+   *     `"consumer"` option is detected.
+   *
+   * @throws {Error}
+   * Thrown when option keys are provided but the `name` key
+   * is missing in `paramObj.opts`.
+   */
+  if ( optsKeys.length === 0 ) {
+    serviceNamePrefix = "producer"
+    paramObj.opts.name = `${serviceNamePrefix}-${paramObj.type}`
+  }
+  else {
+    if( !("name" in paramObj.opts) ){
+      throw new Error("Missing required key \"name\" in optins.")
+    }
+    if ( optsKeys.includes("consumer") ) {
+      serviceNamePrefix = "consumer"
+    }
+  }
+  
+
+  /**
+   * Builds and normalizes the service name and topic pattern
+   * from the provided service configuration.
+   *
+   * Processing steps:
+   * - Creates a unique name segment list using:
+   *   - `serviceNamePrefix`
+   *   - `paramObj.type`
+   *   - Parts extracted from `paramObj.opts.name`
+   * - Removes duplicate segments using `Set`.
+   *
+   * Topic generation:
+   * - If more than two segments exist:
+   *   - Uses segments after the first two as topic names.
+   *   - Converts topic segments to uppercase.
+   *   - Converts a trailing `*` wildcard into Kafka-style `.*`.
+   *   - Joins topic parts using `"."`.
+   * - Otherwise:
+   *   - Uses the default topic pattern `".*"`.
+   *
+   * Consumer-specific behavior:
+   * - When the service type is `"consumer"`:
+   *   - Appends `consumer.groupId` to the final service name.
+   *   - Throws an error if `groupId` is missing.
+   *
+   * Final name normalization:
+   * - Joins all name segments using `"-"`.
+   * - Removes trailing `*` and trailing `-` characters.
+   *
+   * @throws {Error}
+   * Thrown when the service is a consumer and
+   * `consumer.groupId` is not defined.
+   */
+  const splitName = [ ...new Set(
+    [ ...[serviceNamePrefix, paramObj.type], 
+      ...paramObj.opts.name.split("-"),
+    ])
+  ]
+
+  if( splitName.length > 2 ) {
+    const topics = splitName.slice(2).map(e => e.toUpperCase())
+    topics[topics.length - 1] = topics.at(-1)?.replace(/\*$/, ".*")
+    paramObj.opts.topicRegx = topics.join(".")
+  }
+  else{
+    paramObj.opts.topicRegx = '.*'
+  }
+  
+  paramObj.opts.name = splitName.join("-")
+    .replace(/\*$/, "")
+    .replace(/\-$/, "")
+
+  if( splitName[0] == "consumer" ) {
+    if( paramObj.opts?.consumer?.groupId !== undefined ) {
+      paramObj.opts.name = `${paramObj.opts.name}-${paramObj.opts?.consumer?.groupId}`
+    }
+    else {
+      throw new Error("The \"groupId\" key is missing in the consumer options.")
+    }
+  }
+
+}